/*
* The contents of this file are subject to the terms of the Common Development and
* Distribution License (the License). You may not use this file except in compliance with the
* License.
*
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
* specific language governing permission and limitations under the License.
*
* When distributing Covered Software, include this CDDL Header Notice in each file and include
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
* Header, with the fields enclosed by brackets [] replaced by your own identifying
* information: "Portions Copyrighted [year] [name of copyright owner]".
*
* Copyright 2015 ForgeRock AS.
* Portions Copyrighted 2025 3A-Systems LLC.
*/

package org.forgerock.openam.sts.soap.token.provider.oidc;

import org.apache.cxf.sts.request.ReceivedToken;
import org.apache.wss4j.dom.handler.WSHandlerResult;

import java.util.List;

/**
 * OpenIdConnect tokens can include an Authentication Context Class Reference (acr) claim which indicates how the subject
 * asserted by the OIDC token was authenticated. For the rest-sts, this will ultimately be a function of the input token
 * in the token transformation invocation. A default implementation of this interface will be provided, but if users wish
 * to customize the default mappings, or support a specific acr value for a custom token implementation, then they
 * can implement this interface with a classpath-resident class, and specify the name of this class in the OpenIdConnectTokenConfig
 * state associated with the published sts, and that class will be consulted to provide the value of the acr claim corresponding
 * to the input token state.
 */
public interface SoapOpenIdConnectTokenAuthnContextMapper {
    /**
     * Returns the SAML2 AuthnContext class reference corresponding the the SupportingToken specified in the SecurityPolicy
     * bindings protecting a soap-sts instance.
     * @param securityPolicyBindingTraversalYield The yield of SecurityPolicy binding verification, as generated by apache
     *                                            wss4j. See the DefaultSaml2XmlTokenAuthnContextMapper for details on
     *                                            how to parse the classes corresponding to this processing.
     * @return  @return A valid AuthnContext value, as defined here: http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf
     */
    String getAuthnContext(List<WSHandlerResult> securityPolicyBindingTraversalYield);

    /**
     * Returns the SAML2 AuthnContext class reference for delegated tokens (specified as part of the ActAs/OnBehalfOf
     * element in the RequestSecurityToken). The {@code List<WSHandlerResult> } which is the yield of the SecurityPolicy binding
     * traversal, is only provided as additional context, as the manner in which the delegated token was secured may well
     * have bearing on the type of AuthnContext class ref chosen, though it is not examined for the default implementation.
     * @param securityPolicyBindingTraversalYield The yield of SecurityPolicy binding verification, as generated by apache
     *                                            wss4j. See the DefaultSaml2XmlTokenAuthnContextMapper for details on
     *                                            how to parse the classes corresponding to this processing.
     * @param delegatedToken The token provided as part of the ActAs/OnBehalfOf element specified in the RequestSecurityToken.
     * @return  @return A valid AuthnContext value, as defined here: http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf
     */
    String getAuthnContextForDelegatedToken(List<WSHandlerResult> securityPolicyBindingTraversalYield, ReceivedToken delegatedToken);
}
